Description
Invidious before version 2.20260626.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve private playlist contents by accessing the RSS feed playlist endpoint without authentication. Attackers can supply a playlist ID to the feed endpoint to obtain the full playlist contents, owner email address, and associated video entries without any authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| iv-org | Invidious | < 2.20260626.0 | 2.20260626.0 |
References
- Invidious 2.20260626.0 Release Notes release-notes
- Researcher Disclosure issue-tracking
- Pull Request issue-tracking patch
- Patch Commit patch
- https://www.vulncheck.com/advisories/invidious-private-playlist-disclosure-via-unauthenticated-rss-feed-endpoint third-party-advisory